Apparatus and method for developing secure software

Abstract

A computer readable medium includes executable instructions to analyze program instructions for security vulnerabilities. The executable instructions convert diverse program instruction formats to a common format. A system model is derived from the common format. A static analysis is performed on the system model to identify security vulnerabilities. Security vulnerabilities are then reported.

Description

[0001] This application claims priority to the U.S. Provisional Patent Application entitled “Apparatus and Method for Developing, Testing and Monitoring Secure Software”, Ser. No. 60 / 577,066, filed Jun. 4, 2004. This application is related to the following commonly owned and concurrently filed patent applications: “Apparatus and Method for Developing, Testing and Monitoring Secure Software”, U.S. Ser. No. ______, filed Dec. 10, 2004; “Apparatus and Method for Testing Secure Software”, U.S. Ser. No. ______, filed Dec. 10, 2004; “Apparatus and Method for Monitoring Secure Software”, U.S. Ser. No. ______, filed Dec. 10, 2004.BRIEF DESCRIPTION OF THE INVENTION [0002] This invention relates generally to software security. More particularly, this invention relates to comprehensive techniques for identifying software security vulnerabilities during software development, testing and deployment. BACKGROUND OF THE INVENTION [0003] Businesses are increasingly dependent on information technolog...

AI Technical Summary

Benefits of technology

[0011] The invention includes a computer readable medium with executable instructions to analyze program instructions for security vulnerabilities. The executable instructions convert diverse program instruction formats to a common format. A system model is derived from the common format. A static analysis is performed on the system model to identify security vulnerabilities. Security vul

Problems solved by technology

Information systems are becoming increasingly more complex, higher-powered, inter-connected, and openly accessible to partners and customers over vastly distributed networks.

These trends strain the ability of organizations to secure and protect digital data from misuse or unauthorized access.

Nearly every major business critical application deployed today contains vulnerabilities that can be exploited to cause considerable harm to the business or the assets it manages.

An attacker's biggest challenge is simply finding the vulnerabilities in the context of a large business application.

Firewalls and other network-oriented security solutions are not configured to block the type of access that business critical applications require.

In fact, today's business functions rely on this access so much that they would fail to operate if denied.

The true flaw in the outside-in premise, however, is that vulnerable software can be protected at all—somehow made un-vulnerable.

Nevertheless, coherent and practical solutions have not been identified.

There are a number of factors that make solutions difficult to identify.

For example, software security vulnerabilities are subtle, logical errors that can span thousands of lines of code, making accurate detection with reasonable performance extremely difficult.

The large software development tools vendors, however, have not made security a core part of their offerings.

Their customer base is still largely focused on how to improve creation of features and functionality—and the vendors' internal teams cannot easily recognize a changing paradigm while they work to improve the feature sets of their single-purpose products.

In addition, the high volume development tool providers are not adept at delivering enterprise-like solutions that a risk management system requires or sustaining the price points needed to support such a solution.

Indeed, the current state of development tool pricing has generally discouraged the security community from building developer-oriented solutions.

The problem is not just about finding technology to scan code, but includes creating and continually updating rules to detect these vulnerabilities.

Finally, it is unlikely that software security can be accomplished by a single point solution.

Similarly, it is unlikely that software security can be addressed solely at the developer level.

Software security is largely a risk management problem.

Images